EUVD-2026-30804
GHSA-7vv4-j48f-wcx7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SOGo with any user account
-
DeliveryOpen shared calendar or addressbook
-
ExploitSend crafted addUserInAcls request with SQL subquery in uid
-
ExecutionSubquery result written into sogo_acl table
-
PersistRetrieve exfiltrated data via /acls API
-
ImpactIterate to dump credentials and tokens
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold valid credentials for any SOGo account (CVSS PR:L) and have network reach to the SOGo web interface, specifically the ACL management endpoint addUserInAcls on a resource the account can share (calendar or address book). No user interaction, no administrator role, and no non-default configuration is required - SOGo's ACL functionality is enabled by default. The limiting factors are therefore the authentication requirement and exposure of the SOGo web UI; internet-facing or large multi-tenant deployments materially lower the bar, while instances restricted to VPN/SSO and small user populations meaningfully constrain reach. |
| Impact | The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6 and is internally consistent with the description: network-reachable, low complexity, requires low privileges (any authenticated SOGo account), no user interaction, with high confidentiality and integrity impact but no availability impact - matching a data-exfiltration SQLi that also writes attacker-controlled rows. No EPSS value or SSVC decision is provided in the input, so probability of mass exploitation cannot be quantified here. The vulnerability is not on CISA KEV and no public PoC is referenced, but the attack is straightforward and well-documented in the VulnCheck advisory, so weaponization is plausible - especially against multi-tenant SOGo deployments where any low-privilege mailbox user can pivot to full database read. Real-world priority should be treated as high for any internet-facing SOGo instance, slightly tempered by the authenticated-only requirement. |
| Exploit ScenarioDerived | An attacker who controls or phishes any low-privilege SOGo mailbox account opens a shared calendar or address book, captures the addUserInAcls request, and replaces the uid value with a crafted payload such as a subquery selecting password hashes or OIDC tokens from another table. The server stores the subquery result as the ACL entry, and the attacker simply calls /acls to retrieve the exfiltrated data - repeating the loop to dump the database row by row through this out-of-band channel. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 18, 2026
SQL injection in SOGo 5.12.7 (Alinto's open-source groupware/webmail platform) allows authenticated users to exfiltrate arbitrary database contents by injecting subqueries through the uid parameter of the addUserInAcls endpoint, then reading the staged data back via the /acls API. The flaw, reported by VulnCheck (with credit to dninh of SACOMBANK), is fixed in 5.12.8; no public exploit identified at time of analysis and the CVE is not on CISA KEV.
RemediationAI
Vendor-released patch: SOGo 5.12.8 - upgrade immediately following the release notes at https://www.sogo.nu/news/2026/sogo-v5128-released.html (note the vendor warns of possible regressions, mainly in the mail view, after upgrade). If patching must be deferred briefly, restrict reachability of the SOGo web UI to trusted networks or VPN, block or reverse-proxy-filter requests to the /SOGo/so/*/Calendar/.../addUserInAcls and /acls endpoints for non-administrative users, audit the sogo_acl table for anomalous uid values containing SQL metacharacters or subquery syntax, and rotate any credentials or secrets stored in the same database since arbitrary contents may have been read; each of these controls breaks ACL sharing workflows for affected users and should be lifted once 5.12.8 is deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SOGo is a groupware server providing webmail, calendaring, and address-book services, commonly fronted by Apache/nginx and backed by PostgreSQL or MySQL where the sogo_acl table stores Access Control List entries for shared folders. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) here manifests because the addUserInAcls endpoint concatenates the user-supplied uid parameter into the ACL INSERT/UPDATE statement without parameterization, letting an attacker craft a subquery whose result is written into the acl row and then read back through the standard /acls retrieval API - a clean out-of-band channel. CPE cpe:2.3:a:alinto:sogo_webmail:*:*:*:*:*:*:*:* indicates all prior SOGo Webmail builds are in scope, and the vendor release notes confirm the issue affects any previous SOGo version.
Know when Sogo Webmail gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
SOGo 5.12.7 contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.
Executive ViewAI
SOGo 5.12.7, an open-source groupware platform widely used for email and calendaring, contains a SQL injection vulnerability exploitable by any authenticated user (staff, contractors, authorized accounts) to exfiltrate arbitrary database contents. Organizations face elevated insider data theft risk and potential exposure of sensitive communications and contact information. Immediate upgrade to version 5.12.8 is required.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB